Information about Cookies

What is cookie?
Simply put, cookie is a piece of information been passed back and forth between a web server and browser to keep the state of the web surfing session. It is a piece of opaque data. By opaque I mean that its structure is not well understood by the client. It is a piece of data that's stored, then given by the server to the client, stored by the client, and returned to the server each time the client returns. So said the father of cookie, Lou Montulli.
How do cookies work?

Here is the essence of the cookie mechanism:

1. The browser first requests a page on the server;
2. The server sends back a cookie with the requested page to the browser;
3. The browser sends the cookie to the server with subsequent requests.

With the unique information stored in the cookie, the server would be able to tell the identity of the browser by examining the cookie embedded in each request.

The cookies are usually stored in small text files on the hard disk of clients machine, and will be destroyed after its designated expiration date. This type of cookie is also referred as persistent cookie, since they will remain on hard disk even the browser has been closed.

Another type of cookie will be stored in the memory by the browser, called transient cookie or session cookie. They will be destroyed once the browser is closed.

As mentioned earlier, the information stored in the cookie need not be understood by the browser. The browser only needs to return the cookie to the server in the subsequent requests to maintain the state of the surfing session. The information stored inside the cookie are some key/value pairs. These key/value pairs can be anything of the servers choice to facilitate the web application, be it username/password (putting username/password in cookie is a very dangerous thing and generally avoided) or users preferences about the website. This makes the use of cookie very flexible, which is desirable. In the mean time, this flexibility also leads to some poorly designed home-brew web authentication system.

The detailed description of cookie can be found in RFC 2965 HTTP State Management Mechanism (Kristol and Montulli), which was announced on October 7, 2000 by IETF (Internet Engineering Task Force).